JENKINS-47766 Avoid Secret decryption when building SSH clients

src/main/java/com/microsoft/jenkins/azurecommons/remote/SSHClient.java

@@ -44,7 +44,8 @@ public SSHClient(String host, int port, String username, String password) throws
 
     public SSHClient(
             String host, int port, String username, Secret passPhrase, String... privateKeys) throws JSchException {
-        this(host, port, new UsernamePrivateKeyAuth(username, passPhrase, privateKeys));
+        this(host, port, new UsernamePrivateKeyAuth(
+                username, passPhrase == null ? null : passPhrase.getPlainText(), privateKeys));
     }
 
 
@@ -125,7 +126,7 @@ public SSHClient connect() throws JSchException {
         session.setConfig(config);
         if (credentials instanceof UsernamePasswordAuth) {
             session.setPassword(
-                    ((UsernamePasswordAuth) credentials).getPassword().getPlainText());
+                    ((UsernamePasswordAuth) credentials).getPassword());
         }
         session.connect();
         return this;

src/main/java/com/microsoft/jenkins/azurecommons/remote/UsernameAuth.java

@@ -8,28 +8,31 @@
 import com.cloudbees.jenkins.plugins.sshcredentials.SSHUserPrivateKey;
 import com.cloudbees.plugins.credentials.common.StandardUsernameCredentials;
 import com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials;
+import hudson.util.Secret;
 
 /**
  * Abstract SSH authentication credentials with username.
  */
-public abstract class UsernameAuth {
+abstract class UsernameAuth {
     private final String username;
 
-    public UsernameAuth(String username) {
+    UsernameAuth(String username) {
         this.username = username;
     }
 
-    public String getUsername() {
+    String getUsername() {
         return username;
     }
 
-    public static UsernameAuth fromCredentials(StandardUsernameCredentials credentials) {
+    static UsernameAuth fromCredentials(StandardUsernameCredentials credentials) {
         if (credentials instanceof StandardUsernamePasswordCredentials) {
             StandardUsernamePasswordCredentials userPass = (StandardUsernamePasswordCredentials) credentials;
             return new UsernamePasswordAuth(userPass.getUsername(), userPass.getPassword().getPlainText());
         } else if (credentials instanceof SSHUserPrivateKey) {
             SSHUserPrivateKey userKey = (SSHUserPrivateKey) credentials;
-            return new UsernamePrivateKeyAuth(userKey.getUsername(), userKey.getPassphrase(), userKey.getPrivateKeys());
+            Secret passphraseSecret = userKey.getPassphrase();
+            String passphrase = passphraseSecret == null ? null : passphraseSecret.getPlainText();
+            return new UsernamePrivateKeyAuth(userKey.getUsername(), passphrase, userKey.getPrivateKeys());
         } else {
             throw new IllegalArgumentException("Unsupported credentials type " + credentials.getClass().getName());
         }

src/main/java/com/microsoft/jenkins/azurecommons/remote/UsernamePasswordAuth.java

@@ -5,20 +5,18 @@
 
 package com.microsoft.jenkins.azurecommons.remote;
 
-import hudson.util.Secret;
-
 /**
  * SSH authentication credentials with username and password.
  */
-public class UsernamePasswordAuth extends UsernameAuth {
-    private final Secret password;
+class UsernamePasswordAuth extends UsernameAuth {
+    private final String password;
 
-    public UsernamePasswordAuth(String username, String password) {
+    UsernamePasswordAuth(String username, String password) {
         super(username);
-        this.password = Secret.fromString(password);
+        this.password = password;
     }
 
-    public Secret getPassword() {
+    String getPassword() {
         return password;
     }
 }

src/main/java/com/microsoft/jenkins/azurecommons/remote/UsernamePrivateKeyAuth.java

@@ -7,36 +7,35 @@
 
 import com.google.common.collect.ImmutableList;
 import com.microsoft.jenkins.azurecommons.Constants;
-import hudson.util.Secret;
 
 import java.util.Arrays;
 
 /**
  * SSH authentication credentials with username and private keys.
  */
-public class UsernamePrivateKeyAuth extends UsernameAuth {
-    private final Secret passPhrase;
+class UsernamePrivateKeyAuth extends UsernameAuth {
+    private final String passPhrase;
     private final ImmutableList<String> privateKeys;
 
-    public UsernamePrivateKeyAuth(String username, Secret passPhrase, String... privateKeys) {
+    UsernamePrivateKeyAuth(String username, String passPhrase, String... privateKeys) {
         this(username, passPhrase, Arrays.asList(privateKeys));
     }
 
-    public UsernamePrivateKeyAuth(String username, Secret passPhrase, Iterable privateKeys) {
+    UsernamePrivateKeyAuth(String username, String passPhrase, Iterable privateKeys) {
         super(username);
         this.passPhrase = passPhrase;
         //noinspection unchecked
         this.privateKeys = ImmutableList.<String>copyOf(privateKeys);
     }
 
-    public byte[] getPassPhraseBytes() {
+    byte[] getPassPhraseBytes() {
         if (passPhrase == null) {
             return null;
         }
-        return passPhrase.getPlainText().getBytes(Constants.UTF8);
+        return passPhrase.getBytes(Constants.UTF8);
     }
 
-    public ImmutableList<String> getPrivateKeys() {
+    ImmutableList<String> getPrivateKeys() {
         return privateKeys;
     }
 }